Skip to content

Create a Barracuda ADC machine

Create a Barracuda ADC machine so Certificate Manager - SaaS can discover the certificates that the appliance's services use and provision certificates to those services. Certificate Manager - SaaS connects to the appliance's management interface through a VSatellite.

Before you begin

  • The System Administrator, PKI Administrator, or Resource Owner role. If you have the Resource Owner role, you must own or belong to at least one team.
  • An active VSatellite that can reach the appliance's management interface on the web interface port.
  • The hostname or IP address of the Barracuda ADC management interface.
  • The web interface port. You can find it on the appliance's BASIC > Administration page. The default is 8000 for HTTP and 443 for HTTPS.
  • An appliance account with read and write access to services and certificates. Full administrator access isn't required.

To create a Barracuda ADC machine

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click New, and then select Barracuda ADC.
  4. On the Properties step, in Name, enter a name for the machine.
  5. For Owning Team, choose the team that owns the machine. System Administrators and PKI Administrators can choose any team. Resource Owners can choose only a team they own or belong to.

  6. For VSatellite, choose a VSatellite that can reach the machine. A VSatellite that's the primary of a high availability group shows its number of active replicas, and Certificate Manager - SaaS can run the machine's operations on any healthy VSatellite in the group.

  7. In Server Hostname, enter the hostname or IP address of the appliance's management interface.

  8. (Optional) In Port, replace the default, 8000, if the web interface listens on a different port.

  9. (Optional) To connect over HTTPS on a port other than 443, enable Use HTTPS. It's disabled by default.

    Important

    Port doesn't select the protocol on its own. Port 443 always uses HTTPS. On any other port, including 8443, the connection uses plain HTTP unless you enable Use HTTPS, and the sign-in credentials and private keys are sent unencrypted.

  10. For Credential Type, choose how to provide the credentials:

    • Enter Credentials to enter the credentials in the next step. This is the default.
    • Select Credentials to use shared credentials from a credential manager integration. Then, for Credential, choose the credential.

    Note

    Select Credentials requires the credential manager capability, which requires additional licensing. Without it, Credential shows No credentials are available. System Administrators and PKI Administrators can choose any credential. Resource Owners can choose only the credentials that belong to their teams.

  11. If you chose Enter Credentials, enter the appliance account's Username and Password. If you chose Select Credentials, the stored credential needs the same appliance access.

    Note

    Certificate Manager - SaaS encrypts the credentials you enter and doesn't display them again. On the machine's Properties tab, they appear masked. To keep a stored credential when you edit the machine, leave its masked value unchanged. Keep your own secure record of the credentials in case you need them again.

  12. (Optional) If the appliance's management interface uses a self-signed certificate, enable Allow Self-Signed Certificates. It's disabled by default, but the management interface uses a self-signed certificate by default.

    Important

    This setting accepts the appliance's certificate without verifying it. Enable it only for an appliance you reach over a trusted internal network.

    Note

    When this setting is disabled, the appliance's management certificate must chain to a trusted certificate authority (CA) and must be issued for the Server Hostname you entered, in its subject alternative name (SAN). For example, a connection by IP address fails if the certificate was issued only to a hostname.

  13. Click Test Access. After the connection succeeds, click Continue. The Discovery step opens.

    Note

    A successful test confirms that Certificate Manager - SaaS can sign in to the appliance and list its virtual service groups. If the test fails with an authentication error and you know the credentials are correct, check that the account has permission to list the virtual service groups.

  14. (Optional) To leave expired certificates out of the results, enable Exclude Expired Certificates. It's disabled by default. Discovery still downloads every certificate from the appliance to check its expiry, so this setting reduces the reported results but not the traffic to the appliance.

  15. (Optional) To leave out the CA certificates that services use to validate connecting clients, disable Include Client Validation Certificates. It's enabled by default.

    Note

    Discovery finds certificates by reading each service's TLS configuration, because the appliance has no way to list its certificate store. Certificates that no service references aren't discovered, and neither is the appliance's own management interface certificate. If the appliance protects a certificate download with a passphrase, discovery skips that certificate.

  16. (Optional) To discover certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

  17. Click Continue. The Provisioning step opens.

  18. (Optional) To provision certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

    Scheduled provisioning pushes only certificates that are queued for deployment, such as renewed certificates, so renewals install during the window you choose.

  19. Click Finish.

What's next?

After you create the machine, provision a certificate to it. You can also run discovery on the machine at any time to track the certificates that the appliance's services use.